VEX Repository

This is a Trivy-compatible VEX repository — a static set of OpenVEX statements vulnerability scanners can use to suppress findings already assessed as not exploitable.

Consuming this repository

trivy image --vex repo <image>

Trivy discovers this repository via the manifest at .well-known/vex-repository.json, downloads the archive it points to, and matches findings against the packages listed below.

Verifying a signature

Each document is signed keylessly via GitHub Actions OIDC (Fulcio/Rekor). The Signed column below links to the signing bundle, its public transparency log entry, and the workflow run that produced it — you don't need to trust this page, you can check independently:

cosign verify-blob --bundle vex.json.bundle   --certificate-oidc-issuer https://token.actions.githubusercontent.com   --certificate-identity-regexp ".*"   pkg/oci/<slug>/vex.json

Published packages